A number of serious problems have been found over the last year in OpenSSL, which is widely used open-source software that encrypts communications using the SSL/TLS (Secure Sockets Layer/Transport Layer Security) protocol, a cornerstone of Web security.

OpenSSL has been undergoing a security audit since the Heartbleed flaw was found in April 2014, a serious vulnerability that leaked memory from a server, potentially exposing login credentials, cryptographic keys and other private data.

The software was also affected by FREAK, a flaw revealed earlier this month that can allow an attacker to initiate a weaker type of encrypted connection that can be compromised more easily.

OpenSSL’s issues have drawn attention to security issues in other critical open-source software projects, which have often suffered from neglect and been maintained by a handful of underpaid developers or volunteers for free.

As a result, major vendors are funding the Core Infrastructure Initiative, a US$2 million-a-year project dedicated to supporting and auditing open-source projects.

Join the Network World communities on Facebook and LinkedIn to comment on topics that are top of mind.